IT Help Central - Division of Information Technology
Texas Tech University

HELP!!!

IT Help Central

[ Hours of Operation ]
[ Safe Computing ]
[ Customer Survey ]
[ Security Bulletins ]
[ Instructions ]
[ Request Assistance ]
[ Our Team ]
[ Employment ]
[ Strategic Plan ]
[ Site Map ]

Related Sites

[ Texas Tech ]
[ IT Division ]
[ High Tech ]
[ Raiderlink ]
[ Computer Labs ]
[ Training ]
[ TTUHSC Help Desk ]
[ Network Access ]

General Info

[ New Students ]
[ Text-Only Version ]
[ Buying the Right Computer ]

ASC
Room 101
2903 4th Street

W32.Netsky is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. This worm also searches drives C through Y for the folder names containing "Shar", "Share" or "Sharing," and then copies itself to those folders.  There are currently 11 major variants of this worm.

Email Characteristics:  The Subject, Body, and email attachment vary.

Systems Affected:  Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

It is recommended that you view the full article related to these vulnerabilities at Symantec.com

• W32.Netsky.B@mm
• W32.Netsky.C@mm
• W32.Netsky.D@mm
• W32.Netsky.E@mm
• W32.Netsky.K@mm
• W32.Netsky.P@mm
• W32.Netsky.Q@mm
• W32.Netsky.S@mm
• W32.Netsky.T@mm
• W32.Netsky.X@mm
• W32.Netsky.Y@mm
• W32.Netsky.Z@mm
• W32.Netsky.AB@mm

Quick Fix Instructions

1. Download the FxNetsky.exe file from IT Help Central
2. Save the file to a convenient location, such as your download folder or the Windows desktop (or removable media that is known to be uninfected, if possible).
3. To check the authenticity of the digital signature, refer to the section, "Digital signature."
4. Close all programs before you run the tool.
5. If you are on a network or have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
6. If you are running Windows Me or XP, disable System Restore. Please refer to the section "System Restore option in Windows Me/XP" for additional details.
   
   CAUTION: If you are running Windows Me/XP, we strongly recommend that you do not skip this step. The removal procedure may be unsuccessful if Windows Me/XP System Restore is not disabled, because Windows prevents outside programs from modifying System Restore.
    
7. Double-click the FxNetsky.exe file to start the removal tool.
8. Click Start to begin the process, and then allow the tool to run.
   
   NOTE: If, when running the tool, you see a message that the tool was not able to remove one or more files, run the tool in Safe mode. Shut down the computer, turn off the power, and wait 30 seconds. Restart the computer in Safe mode and run the tool again. All the Windows 32-bit operating systems, except Windows NT, can be restarted in Safe mode. For instructions, read the document "How to start the computer in Safe Mode."
    
9. Restart the computer.
10. Run the removal tool again to ensure that the system is clean.
11. If you are running Windows Me or XP, then re-enable System Restore.
12. Run Live Update to make sure that you are using the most current virus definitions.

For specific details on each of these steps, please follow this link.